apostrophe vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-112952Mediumapostrophe: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userCVE-2026-112957Mediumapostrophe: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to…CVE-2026-112958Mediumapostrophe: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute SerializationCVE-2026-112954Mediumapostrophe: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APICVE-2026-112951Mediumapostrophe: ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixCVE-2026-113649Medium@apostrophecms/import-export: ApostropheCMS: Import API bypasses publication roles for protected contentCVE-2026-113711Highapostrophe: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportCVE-2026-113653Mediumapostrophe: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)CVE-2026-113665Lowapostrophe: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE EndpointsCVE-2026-113660Mediumapostrophe: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft IdentifiersCVE-2026-113659Mediumapostrophe: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersCVE-2026-113710Mediumapostrophe: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password GuessingCVE-2026-113668Mediumapostrophe: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated…CVE-2026-113670Mediumapostrophe: ApostropheCMS: Page REST API authorization bypassCVE-2026-113658Highapostrophe: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryCVE-2026-113669Mediumapostrophe: ApostropheCMS: Cross-domain session token in URL confers session takeoverCVE-2026-113655Mediumapostrophe: ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationCVE-2026-113666High@apostrophecms/db-connect: ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of…CVE-2026-63669Mediumapostrophe: ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a…CVE-2026-71553Highapostrophe: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSCVE-2026-53607Lowapostrophe: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headerCVE-2026-53609Criticalapostrophe: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassCVE-2026-45011Highapostrophe: Apostrophe has stored XSS via javascript: URL in Image Widget LinkCVE-2026-45013Highapostrophe: Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input ValidationCVE-2026-45012Highapostrophe: Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo